What counts as personal data under GDPR, CCPA and NIST guidance?

Personal data is any information relating to an identified or identifiable person. That includes obvious items like names and ID numbers, and also indirect ones such as online identifiers and location data. If a record can be linked back to an individual, treat it as personal data until you have shown otherwise.

How does GDPR define it?

Article 4 of the General Data Protection Regulation says personal data means any information relating to an identified or identifiable natural person, called the data subject. An identifiable person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Two words do most of the work: "relating to" and "indirectly." A customer ID in a database looks harmless, but if your team can join it to an account, the ID is personal data.

Article 4 also defines pseudonymisation: processing so that data can no longer be attributed to a specific person without additional information, where that information is kept separately and protected by technical and organisational measures. Pseudonymised data is still personal data under that wording, because the additional information exists and can reverse it.

What does California's CCPA use?

The California Attorney General's page describes rights over "personal information" that businesses collect: the right to know what is collected and how it is used and shared, the right to delete, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination. After the 2020 ballot measure known as CPRA amended the law, consumers also gained the right to correct inaccurate personal information and the right to limit use and disclosure of sensitive personal information. The page gives examples of sensitive data: Social Security number, financial account information, precise geolocation and genetic data.

The state names a different term, "personal information," but the practical question is the same. What do you hold, and can it be tied to a person?

What does NIST add?

NIST SP 800-122 uses the term PII. It quotes a definition of any information about an individual maintained by an agency, including information that can be used to distinguish or trace an identity, such as name, Social Security number, date and place of birth, mother's maiden name or biometric records, and any other information that is linked or linkable to an individual, such as medical, educational, financial and employment information.

Its examples include names, personal identification numbers, address information including email, personal characteristics such as photographs and fingerprints, and linked information such as date of birth, race, religion, weight, activities and geographical indicators.

NIST also gives a method. Organizations should categorize PII by confidentiality impact level, low, moderate or high, using factors the organization chooses, and should minimize the PII they collect, use and retain to what is strictly necessary.

A constructed example

A fitness app stores a random user ID, a daily step count and a postcode. No name, no email. Is it personal data? Under the GDPR wording, probably yes: the ID singles out one person over time, and a postcode plus activity pattern can point to an individual. Under NIST's list, geographical indicators and activities appear explicitly as linked information. Delete the postcode, store only a region, and the risk drops, but the user ID still links records to one person.

Where do developers hit this?

Logs are the usual surprise. IP addresses, email addresses in error messages, session tokens and device identifiers all end up in log files. So do request bodies in debugging output. Analytics events, crash reports and support tickets are the same story.

How to check or apply this

1. Make a data inventory: systems, fields, purposes, owners and retention. NIST warns that you cannot protect PII you do not know about, and lists databases, shared drives, backup tapes and contractor sites as places to look.
2. For each field ask: does this relate to a person, directly or by combination with other data we hold?
3. Classify by impact: what harm follows if this leaks?
4. Collect less. Remove fields nobody uses and set retention limits.
5. Scrub logs and error output for identifiers before they are stored.
6. Pseudonymise where you can, keep the key separate and treat the result as still personal.
7. Record which law applies to which users. This post explains terms, and a lawyer should confirm how they apply to you.

Safeguard's compliance automation helps map controls to frameworks, and its dependency scanning flags known vulnerabilities in the libraries that handle this data. It does not decide what counts as personal data for you.

Quick check

Sources

• GDPR Article 4, Definitions
• California Attorney General, California Consumer Privacy Act
• NIST SP 800-122, Guide to Protecting the Confidentiality of PII

Last reviewed: 18 October 2026.